r/PowerShell • u/Im_a_PotatOS • 15d ago

News 13 New Vulnerabilities in PowerShell 7

The PowerShell team just announced 13 new security vulnerabilities affecting PowerShell 7.4, 7.5, and 7.6 with severities ranging from 5.9 (Moderate) to 8.8 (High).

This is likely the largest number of security vulnerabilities fixed in any one release in the history of PowerShell.

You can read more about them here: Security Issues - PowerShell/Announcments

PowerShell 7 Version Affected version Patched Version
7.6 <7.6.5 7.6.5
7.5 <7.5.10 7.5.10
7.4 <7.4.19 7.4.19
61 Upvotes

96% Upvoted

8 comments sorted by

View all comments

22

u/jborean93 15d ago

I wouldn’t consider the majority of these issues as PowerShell but rather .NET assemblies that PowerShell ships with. They’ve had these security issues and so pwsh needs to be updated to ship the newer assemblies. Maybe your code uses the affected assemblies and the specific types affected but most likely not from a client side perspective.

This is also going to be a common thing in the near future with AI tools finding these types of issues left right and centre so buckle up for every patch Tuesday.

5

u/BlackV 15d ago

That's 1 minor positive of AI finding this stuff , might make people write more secure robust code (ignoring the maybe not so good code AI writes now)

3

u/jborean93 15d ago

Yea I definitely expect the new few years to be rough when it comes to security issues and 0 days but on the bright side if it dan find these bugs so easily then so can developers in their own code.

1

u/RikiWardOG 14d ago

No, AI in some ways is already outpacing what devs can find and it's only getting better at it. Most devs have maybe some understanding of security but they certainly don't think security first and certainly aren't experts in security. I mean we're seeing AI finding crazy VM escapes even. AI doesn't sleep and can pull from multiple disciplines in a way that humans just can't and can iterate at crazy speed. I'm really concerned AI is going to cause a lot more harm than good.

2

u/jborean93 14d ago

No, AI in some ways is already outpacing what devs can find and it's only getting better at it. Most devs have maybe some understanding of security but they certainly don't think security first and certainly aren't experts in security

That's my point, devs by themselves no as that's the status quo. But if someone can use AI to find these vulnerabilities then nothing stops the devs themselves from running it on their own code and either fixing existing problems and stopping new vulnerabilities being added.

It's not going to be perfect, especially since it means we as devs need to adjust our workflows to utilise these tools.